diff options
| author | zsdc <taras@vyos.io> | 2023-09-26 11:27:07 +0300 |
|---|---|---|
| committer | zsdc <taras@vyos.io> | 2023-11-20 19:07:11 +0200 |
| commit | d7457268fcaa5626e512eb00a9aab36f4a617f28 (patch) | |
| tree | b44029f81f1a47a86b475a00d0b22587addfd2db /interface-definitions | |
| parent | 471e26233e2e1c7b4ad20aff673a18ac5d745296 (diff) | |
| download | vyos-1x-d7457268fcaa5626e512eb00a9aab36f4a617f28.tar.gz vyos-1x-d7457268fcaa5626e512eb00a9aab36f4a617f28.zip | |
PAM: T5577: Optimized RADIUS PAM config
- Added system `radius` group
- Added `mandatory` and `optional` modes for RADIUS
- Improved PAM config for RADIUS
New modes:
- `mandatory` - if RADIUS answered with `Access-Reject`, authentication must be
stopped and access denied immediately.
- `optional` (default) - if RADIUS answers with `Access-Reject`, authentication
continues using the next module.
In `mandatory` mode authentication will be stopped only if RADIUS clearly
answered that access should be denied (no user in RADIUS database, wrong
password, etc.). If RADIUS is not available or other errors happen, it will be
skipped and authentication will continue with the next module, like in
`optional` mode.
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/include/radius-server-ipv4-ipv6.xml.i | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/interface-definitions/include/radius-server-ipv4-ipv6.xml.i b/interface-definitions/include/radius-server-ipv4-ipv6.xml.i index 5b12bec62..6a432bac9 100644 --- a/interface-definitions/include/radius-server-ipv4-ipv6.xml.i +++ b/interface-definitions/include/radius-server-ipv4-ipv6.xml.i @@ -47,6 +47,26 @@ <multi/> </properties> </leafNode> + <leafNode name="security-mode"> + <properties> + <help>Security mode for RADIUS authentication</help> + <completionHelp> + <list>mandatory optional</list> + </completionHelp> + <valueHelp> + <format>mandatory</format> + <description>Deny access immediately if RADIUS answers with Access-Reject</description> + </valueHelp> + <valueHelp> + <format>optional</format> + <description>Pass to the next authentication method if RADIUS answers with Access-Reject</description> + </valueHelp> + <constraint> + <regex>(mandatory|optional)</regex> + </constraint> + </properties> + <defaultValue>optional</defaultValue> + </leafNode> </children> </node> <!-- include end --> |